Commit Graph

  • 26dad96748 rdp_artifacts_and_evasion Teoderick Contreras 2025-08-07 14:25:22 +02:00
  • d6d76b7c2e rdp_artifacts_and_evasion Teoderick Contreras 2025-08-07 14:16:43 +02:00
  • f47bc213c6 rdp_artifacts_and_evasion Teoderick Contreras 2025-08-07 14:14:39 +02:00
  • ec236fd807 rdp_artifacts_and_evasion Teoderick Contreras 2025-08-07 14:09:06 +02:00
  • fcb5e9977b more_interlock_rat Teoderick Contreras 2025-08-07 13:50:17 +02:00
  • fc4089f8bd Updated TAs patel-bhavin 2025-08-07 07:02:29 +00:00
  • 5097cd5fef removed detections and version bump Bhavin Patel 2025-08-06 14:08:17 -05:00
  • 3fd2a02f18 Bump versions Raven Tait 2025-08-06 11:00:30 -05:00
  • 39b85548d2 Add Medusa content Raven Tait 2025-08-06 10:16:03 -05:00
  • 8df99e4e2b rdp_artifacts_and_evasion Teoderick Contreras 2025-08-06 13:02:46 +02:00
  • 57a48ff2d0 Merge branch 'rdp_artifacts_and_evasion' of https://github.com/splunk/security_content into rdp_artifacts_and_evasion Teoderick Contreras 2025-08-06 12:37:00 +02:00
  • 11ac4846c4 rdp_artifacts_and_evasion Teoderick Contreras 2025-08-06 12:36:46 +02:00
  • ce1bfce684 Merge branch 'develop' into rdp_artifacts_and_evasion Br3akp0int 2025-08-06 11:49:38 +02:00
  • fe7807274f rdp_artifacts_and_evasion Teoderick Contreras 2025-08-06 10:55:23 +02:00
  • 2dde8e118b Updates for 3886 Raven Tait 2025-08-05 12:32:01 -05:00
  • 97950fee31 Merge pull request #3630 from splunk/app_dynamics_udpate v5.11.0 Bhavin Patel 2025-08-04 15:50:26 -05:00
  • ef128df886 updating spl Bhavin Patel 2025-08-04 14:53:47 -05:00
  • 716592ff40 updating spl Bhavin Patel 2025-08-04 14:48:58 -05:00
  • 75b307f0f8 updating def Bhavin Patel 2025-08-04 14:47:09 -05:00
  • 8a8e24ff29 adding macro Bhavin Patel 2025-08-04 14:45:49 -05:00
  • ab80c31b85 appinspect Bhavin Patel 2025-08-04 14:38:02 -05:00
  • c6c2175f2a move to prod Bhavin Patel 2025-08-04 14:00:19 -05:00
  • 2c6248de85 updating based on request from Ryan Long Bhavin Patel 2025-08-04 13:56:35 -05:00
  • 4e1eb8219c Merge pull request #3629 from splunk/issue_3625 Bhavin Patel 2025-08-04 13:37:24 -05:00
  • 785931237d minor fix Bhavin Patel 2025-08-04 13:20:56 -05:00
  • 0a05162a40 Merge pull request #3626 from splunk/scatteringspider Bhavin Patel 2025-08-01 12:46:04 -05:00
  • 6960b280ef Merge branch 'develop' into scatteringspider Michael Haag 2025-08-01 11:18:16 -06:00
  • df7ccd3624 Merge pull request #3627 from jakeenea51/aad_time_window Bhavin Patel 2025-08-01 11:25:26 -05:00
  • 7883693801 Merge branch 'develop' into scatteringspider Michael Haag 2025-08-01 10:21:00 -06:00
  • 9b80133479 Merge branch 'develop' into aad_time_window Bhavin Patel 2025-08-01 11:10:44 -05:00
  • b7b708478b Merge pull request #3621 from splunk/interlock_ransomware Bhavin Patel 2025-08-01 11:08:01 -05:00
  • 970cce7351 rdp_artifacts_and_evasion Teoderick Contreras 2025-08-01 10:18:59 +02:00
  • 8c265f4881 rdp_artifacts_and_evasion Teoderick Contreras 2025-08-01 10:13:08 +02:00
  • e4cfd3c338 aad multiple denied mfa requests: updating version and date Jake Enea 2025-07-31 20:42:11 -04:00
  • 11a2f6a4ce aad multiple denied mfa requests: add _time in 'stats count by' to limit to 10 min windows Jake Enea 2025-07-31 20:37:59 -04:00
  • 968d460fde Merge branch 'develop' into interlock_ransomware Bhavin Patel 2025-07-31 10:02:26 -07:00
  • 03f37bc312 udpated verison Bhavin Patel 2025-07-31 12:01:38 -05:00
  • ea0121c2f1 Scattered Spider Tags Michael Haag 2025-07-31 10:54:21 -06:00
  • dbc7dd12e8 Scattered Spider Ashes Michael Haag 2025-07-31 10:34:07 -06:00
  • 7669859758 prep for sysmon 5 release Bhavin Patel 2025-07-30 13:15:33 -05:00
  • fe96c82cba interlock_ransomware Teoderick Contreras 2025-07-30 17:18:55 +02:00
  • 332f641d93 updating for testing sysmon_5 Bhavin Patel 2025-07-30 08:26:32 -05:00
  • 6ac8e21af5 Merge pull request #3622 from splunk/auto-ta-update-341 Lou Stella 2025-07-29 08:03:19 -05:00
  • d97a6d1dc2 interlock_ransomware Teoderick Contreras 2025-07-29 12:34:34 +02:00
  • 905a1041d2 interlock_ransomware Teoderick Contreras 2025-07-29 12:31:56 +02:00
  • f61b3993ed interlock_ransomware Teoderick Contreras 2025-07-29 12:07:08 +02:00
  • d6febb57c4 interlock_ransomware Teoderick Contreras 2025-07-29 12:05:44 +02:00
  • 391fedba18 Updated TAs patel-bhavin 2025-07-29 07:01:46 +00:00
  • a84e350cc7 Merge branch 'develop' into interlock_ransomware Bhavin Patel 2025-07-28 12:45:22 -07:00
  • 775402fecc Merge pull request #3618 from 0xC0FFEEEE/bec_rule_threshold Bhavin Patel 2025-07-28 12:45:06 -07:00
  • e9735eb6bd Merge branch 'develop' into bec_rule_threshold Bhavin Patel 2025-07-28 11:10:33 -07:00
  • 4fdf8e12b1 interlock_ransomware Teoderick Contreras 2025-07-28 12:03:18 +02:00
  • 96786372a3 interlock_ransomware Teoderick Contreras 2025-07-28 11:58:45 +02:00
  • e5512da103 interlock_ransomware Teoderick Contreras 2025-07-28 11:57:35 +02:00
  • 60a16851b1 interlock_ransomware Teoderick Contreras 2025-07-28 11:43:38 +02:00
  • d12d2f27a7 Merge branch 'interlock_ransomware' of https://github.com/splunk/security_content into interlock_ransomware Teoderick Contreras 2025-07-28 11:34:24 +02:00
  • d2a731dbdc interlock_ransomware Teoderick Contreras 2025-07-28 11:20:47 +02:00
  • 7fafccfd8c interlock_ransomware Teoderick Contreras 2025-07-28 11:20:47 +02:00
  • 6c857aac76 interlock_ransomware Teoderick Contreras 2025-07-28 11:13:15 +02:00
  • b62c21bda0 Merge pull request #3620 from splunk/contentctl_attack_data_cache pyth0n1c 2025-07-24 15:26:02 -07:00
  • f94e0cc080 Merge branch 'develop' into contentctl_attack_data_cache pyth0n1c 2025-07-24 15:23:33 -07:00
  • 59c0aef06e Merge branch 'develop' into bec_rule_threshold Bhavin Patel 2025-07-24 14:32:03 -07:00
  • a599512e15 configure contentctl.yml to use attack data cache Tessa Georgen 2025-07-24 15:45:53 -04:00
  • 3ccf82c437 update risk message 0xC0FFEEEE 2025-07-24 09:00:34 +01:00
  • 1562bec708 Merge pull request #3619 from splunk/ctl_511 Bhavin Patel 2025-07-23 15:11:25 -07:00
  • 5031206e56 version bump for next release Bhavin Patel 2025-07-23 13:20:07 -07:00
  • aca4613bcb Merge pull request #3616 from splunk/auto-ta-update-334 Lou Stella 2025-07-23 12:51:18 -05:00
  • 1032077679 Add rule name to risk message 0xC0FFEEEE 2025-07-23 09:42:34 +01:00
  • afefa1506c use correct drilldown field 0xC0FFEEEE 2025-07-23 09:41:21 +01:00
  • 43fa38ef77 Add threshold filter 0xC0FFEEEE 2025-07-23 09:39:53 +01:00
  • 55bb6bec33 Updated TAs auto-ta-update-335 patel-bhavin 2025-07-23 07:01:57 +00:00
  • 6755ee0a5a Updated TAs patel-bhavin 2025-07-22 07:01:02 +00:00
  • e8883750af Merge pull request #3615 from splunk/data_source_bug v5.10.0 Bhavin Patel 2025-07-21 15:06:47 -07:00
  • d3082fc262 minor Bhavin Patel 2025-07-21 14:43:12 -07:00
  • 483c7d2d12 Merge pull request #3613 from splunk/sharepoint Bhavin Patel 2025-07-21 14:20:15 -07:00
  • 299f54a1e7 Merge branch 'develop' into sharepoint Bhavin Patel 2025-07-21 14:04:54 -07:00
  • 6d8a08fc91 Merge pull request #3609 from splunk/quasar_and_loader Bhavin Patel 2025-07-21 14:04:44 -07:00
  • 227216ec39 Create windows_sharepoint_spinstall0_webshell_file_creation.yml Michael Haag 2025-07-21 13:57:05 -06:00
  • f6a5de35a4 Merge branch 'sharepoint' of https://github.com/splunk/security_content into sharepoint Michael Haag 2025-07-21 13:11:44 -06:00
  • 4e3598c522 Update windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml Michael Haag 2025-07-21 13:11:43 -06:00
  • 1075307e29 Update detections/network/windows_gather_victim_network_info_through_ip_check_web_services.yml Nasreddine Bencherchali 2025-07-21 21:01:20 +02:00
  • 955b4af394 Merge branch 'develop' into quasar_and_loader Bhavin Patel 2025-07-21 11:20:16 -07:00
  • 5c707ed2fa Merge branch 'develop' into sharepoint Bhavin Patel 2025-07-21 10:33:38 -07:00
  • db45a47e94 Merge pull request #3602 from splunk/duo_detections_1 Bhavin Patel 2025-07-21 10:29:12 -07:00
  • e434b1ac3f remove extraquote Bhavin Patel 2025-07-21 09:44:10 -07:00
  • 65291ca170 Merge branch 'develop' into duo_detections_1 Bhavin Patel 2025-07-21 09:03:48 -07:00
  • c5838d60da Create windows_sharepoint_spinstall0_get_request.yml Michael Haag 2025-07-21 09:28:05 -06:00
  • 0329943742 Merge pull request #3614 from splunk/missing-ds Nasreddine Bencherchali 2025-07-21 16:53:53 +02:00
  • b96739ccd4 Update cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml Nasreddine Bencherchali 2025-07-21 16:37:38 +02:00
  • 5e76f21e6f Update cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml Nasreddine Bencherchali 2025-07-21 16:34:06 +02:00
  • 034c2a7bf6 feedback review Patrick Bareiss 2025-07-21 09:47:20 +02:00
  • 13b49f5456 Sharing is Caring: A story of CVE-2025-53770 Michael Haag 2025-07-20 17:03:37 -06:00
  • efc331be05 Merge branch 'develop' into duo_detections_1 Bhavin Patel 2025-07-18 13:50:53 -07:00
  • f3505b9a33 Merge branch 'develop' into quasar_and_loader Bhavin Patel 2025-07-18 12:17:52 -07:00
  • 84d8f198b2 Merge pull request #3610 from splunk/esxi_detections Bhavin Patel 2025-07-18 12:17:37 -07:00
  • 8e02ae92a9 Merge branch 'esxi_detections' of https://github.com/splunk/security_content into esxi_detections Raven Tait 2025-07-18 14:56:31 -04:00
  • c7974920c3 add output_fields to datasource Raven Tait 2025-07-18 14:56:30 -04:00
  • c30632444c Merge branch 'develop' into esxi_detections Bhavin Patel 2025-07-18 11:38:02 -07:00
  • 51131fff17 Merge pull request #3588 from splunk/citrixbleed2 Bhavin Patel 2025-07-18 11:37:44 -07:00
  • c8ed36821e Merge branch 'develop' into esxi_detections Lou Stella 2025-07-18 11:27:55 -05:00